Monitoring Splunk

How to calculate the free disk capacity in MB?

jip31
Motivator

hello

I use this code `in order to calculate the free disk space but I also need to know the capacity disk in MB. I am unable to find a counter for this. The value has to be displayed in the "x" variable. Could you help me, please?

| join type=outer host [search index="perfmon" sourcetype="perfmon:logicaldisk" instance=c:  counter="Free Megabytes" | eval Disk_Available_Space =round(Value, 0). " MBytes /x" ]
0 Karma
1 Solution

FrankVl
Ultra Champion

Doesn't perfmon also have a % Free Space counter that you can use for this?

You can use the combination of those 2 counters to calculate the total space, for example (tune this to exactly what you need)

search index="perfmon" sourcetype="perfmon:logicaldisk" instance=c:  counter="Free Megabytes" OR counter="% Free Space"
| eval perc_free = if(counter="% Free Space",Value,null)
| eval mb_free = if(counter="Free Megabytes",Value,null)
| stats latest(mb_free) as mb_free latest(perc_free) as perc_free by instance,host
| eval total_space = mb_free / (perc_free) * 100

View solution in original post

0 Karma

FrankVl
Ultra Champion

Doesn't perfmon also have a % Free Space counter that you can use for this?

You can use the combination of those 2 counters to calculate the total space, for example (tune this to exactly what you need)

search index="perfmon" sourcetype="perfmon:logicaldisk" instance=c:  counter="Free Megabytes" OR counter="% Free Space"
| eval perc_free = if(counter="% Free Space",Value,null)
| eval mb_free = if(counter="Free Megabytes",Value,null)
| stats latest(mb_free) as mb_free latest(perc_free) as perc_free by instance,host
| eval total_space = mb_free / (perc_free) * 100
0 Karma

jip31
Motivator

sorry but i dont succeed
in my field i Something like this :`mb_free "MB" / total_space "MB"

0 Karma

FrankVl
Ultra Champion

Can you please stop posting comments as answers. I can convert them to comments, but it is easier if you post them as a comment right away 🙂

Given that the data is in the fields mb_free and total_space. This should work to print it as you want:

| eval Disk_Available_Space = round(mb_free,0)."MB / ".round(total_space,0)."MB"
0 Karma

jip31
Motivator

yes but i done this and it dont works

 eval Disk_Available_Space =round(Value, 0). " MBytes /.total_space" | table Disk_Available_Space
0 Karma

FrankVl
Ultra Champion

You need to take that part outside of the quotes.

0 Karma

jip31
Motivator

Perfect thanks
last question i want mb free band total space in a same field seperated by \

0 Karma

FrankVl
Ultra Champion

You already pretty much had the code for that right? Just use .total_space to concatenate the total_space field to the string you already generated.

0 Karma

jip31
Motivator

% Free Space dont give me directly the total space...

0 Karma

FrankVl
Ultra Champion

See my updated answer for how you can combine the 2 counters to calculate that.

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...